thomaspatzke/log4pot

A honeypot for the Log4Shell vulnerability (CVE-2021-44228).

log4pot's Issues

Attempt to run Log4pot

Hello,

I am trying to run log4pot.py without any dependencies as mentioned in the Readme, as follows: python log4pot.py -p 8080

I am having a syntax error on line 96: if (m := ).
This is an invalid syntax, also what is the m variable?

Please note, I tried to replace it with if (m==), I got an error that m is not defined.

Any help please on this?
Thank you

Exception

Just noticed the following exception:

----------------------------------------
Exception occurred during processing of request from ('x.x.x.x', 55160)
Traceback (most recent call last):
  File "/usr/lib/python3.9/socketserver.py", line 683, in process_request_thread
    self.finish_request(request, client_address)
  File "/usr/lib/python3.9/socketserver.py", line 360, in finish_request
    self.RequestHandlerClass(request, client_address, self)
  File "/usr/lib/python3.9/socketserver.py", line 747, in __init__
    self.handle()
  File "/usr/lib/python3.9/http/server.py", line 427, in handle
    self.handle_one_request()
  File "/usr/lib/python3.9/http/server.py", line 395, in handle_one_request
    self.raw_requestline = self.rfile.readline(65537)
  File "/usr/lib/python3.9/socket.py", line 704, in readinto
    return self._sock.recv_into(b)
ConnectionResetError: [Errno 104] Connection reset by peer
----------------------------------------
x.x.x.x - - [16/Dec/2021 13:44:23] "GET / HTTP/1.1" 200 -
x.x.x.x - - [16/Dec/2021 13:44:23] "GET / HTTP/1.1" 200 -

The according JSON log:

{"type": "request", "timestamp": "2021-12-16T13:44:23.029029", "correlation_id": "39f57c86-3b8a-46da-8ac1-568030215755", "server_port": 80, "client": "x.x.x.x", "port": 41482, "request": "GET / HTTP/1.1", "headers": {"Host": "y.y.y.y:80"}}
{"type": "request", "timestamp": "2021-12-16T13:44:23.258082", "correlation_id": "c01af0fb-dcdc-41f3-af09-8680c6c99d81", "server_port": 80, "client": "x.x.x.x", "port": 37514, "request": "GET / HTTP/1.1", "headers": {"Host": "y.y.y.y", "User-Agent": "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)", "Accept": "*/*", "Accept-Encoding": "gzip"}}

Getting an error: No module named 'pycurl'

Hello,

Is anyone getting this error:

Pycurl not available or there is an issue with curl dependencies: No module named 'pycurl'

I tried installing pycurl for both Python2 and Python3, using these commands.

pip install pycurl

pip3 install pycurl

Both of these were already satisfied.

T-Pot integration

@thomaspatzke Great work, thank you!
Did not find a license, are you ok with T-Pot integration?

error on non-azure installation

FYI --

$ python3 log4pot.py @log4pot.conf
Azure dependencies not installed, logging to blob storage not available.
usage: log4pot.py [-h] [--port PORT] [--log LOG] [--blob-connection-string BLOB_CONNECTION_STRING] [--log-container LOG_CONTAINER] [--log-blob LOG_BLOB] [--server-header SERVER_HEADER]
log4pot.py: error: unrecognized arguments: storage connection string as provided in UI>

attempt to run Log4Pot

..